Submission Summary:

• Submission details:
• Submission received: 11 February 2013, 09:43:09
• Processing time: 6 min 16 sec
• Submitted sample:
• File MD5: 0xCF1A44A0F204CD56223190298255A34E
• File SHA-1: 0xCE25C1C84CFD609173035A0A2F0F0752EA84499A
• Filesize: 31,996 bytes
• Alias:
• Backdoor.Bifrose [Symantec]
• Backdoor.Win32.Bifrose.fxu [Kaspersky Lab]
• BackDoor-CEP.gen.cm [McAfee]
• Mal/Bifrose-X [Sophos]
• Backdoor:Win32/Bifrose.HZ [Microsoft]
• Virus.Win32.Bifrose [Ikarus]
• Win-Trojan/Bifrose.31964 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Backdoor.Bifrose	Backdoor.Bifrose is a backdoor trojan that attempts to propagate by exploiting local network shares. It will also attempt to join a predefined IRC server and channel in order to participate in DDoS attacks.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
server.exe	%System%\Bifrost\server.exe	35,168 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	35,168 bytes

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• Attention! The following processes were intentionally hidden from the user:

Process Name	Main Module Size
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes
IEXPLORE.EXE	102,400 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
• HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Bifrost

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]
• stubpath = "%System%\Bifrost\server.exe s"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost]
• nck = ED 1B E6 27 B9 28 D6 32 74 C3 CD 74 FA 93 5B 67
• [HKEY_CURRENT_USER\Software\Bifrost]
• klg = 00

Other details

• To mark the presence in the system, the following Mutex object was created:
• Bif123

• The following Host Names were requested from a host database:
• psico-hacker.no-ip.biz
• 192.5.5.241

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 81: